Spring/spring-webflow
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

polish

Browse Source
This commit is contained in:
Scott Andrews
2008-04-11 16:21:48 +00:00
parent d7f07af5a5
commit 2c2dc09dbf
4 changed files with 84 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
spring-webflow-reference/src/flow-definition-field-mappings.xml
View File

@@ -3,7 +3,7 @@
<title>Flow Definition Language 1.0 to 2.0 Mappings</title>
<para>
The flow definition language has changed since the 1.0 release.
This is a listing of the language elements in the 1.0 release, and how they convert to element in the 2.0 release.
This is a listing of the language elements in the 1.0 release, and how they map to elements in the 2.0 release.
While most of the changes are semantic, there are a few structural changes.
Please see the upgrade guide for more details about changes between Web Flow 1.0 and 2.0.
</para>
@@ -39,7 +39,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
use evaluate
use &lt;evaluate /&gt;
</entry>
</row>
<row>
@@ -102,7 +102,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
arguments can be used in evaluate
use &lt;evaluate expression="func(arg1, arg2, ...)"/&gt;
</entry>
</row>
<row>
@@ -159,7 +159,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
input/output can be in flow/subflow directly
input and output elements can be in flows or subflows directly
</entry>
</row>
<row>
@@ -170,7 +170,7 @@
*
</entry>
<entry colname="comments">
now subflow-state subflow-attribute-mapper
now subflow-attribute-mapper attribute on subflow-state
</entry>
</row>
</tbody>
@@ -183,7 +183,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
use evaluate
use &lt;evaluate /&gt;
</entry>
</row>
<row>
@@ -324,7 +324,7 @@
*
</entry>
<entry colname="comments">
use attribute name=”name”
use &lt;evaluate ...&gt; &lt;attribute name=”name” value="..." /&gt; &lt;/evaluate&gt;
</entry>
</row>
<row>
@@ -353,7 +353,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
use result attribute on evaluate
use &lt;evaluate result="..." /&gt;
</entry>
</row>
<row>
@@ -506,7 +506,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
convert to top level flow
convert to new top-level flow
</entry>
</row>
<row>
@@ -543,7 +543,7 @@
*
</entry>
<entry colname="comments">
prefix name with scope, ie flowScope.foo
prefix name with scope &lt;input name="flowScope.foo" /&gt;
</entry>
</row>
<row>
@@ -580,7 +580,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
input can be in flow/subflow directly
inputs can be in flows and subflows directly
</entry>
</row>
</tbody>
@@ -663,7 +663,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
use evaluate
use &lt;evaluate expression="func(arg1, arg2, ...)"/&gt;
</entry>
</row>
</tbody>
@@ -676,7 +676,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
use evaluate
use &lt;evaluate result="..." /&gt;
</entry>
</row>
<row>
@@ -721,7 +721,7 @@
*
</entry>
<entry colname="comments">
prefix name with scope, ie flowScope.foo
prefix name with scope &lt;output name="flowScope.foo" /&gt;
</entry>
</row>
<row>
@@ -758,7 +758,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
output can be in flow/subflow directly
output can be in flows and subflows directly
</entry>
</row>
</tbody>
@@ -797,7 +797,7 @@
*
</entry>
<entry colname="comments">
prefix name with scope, ie flowScope.foo
prefix name with scope &lt;set name="flowScope.foo" /&gt;
</entry>
</row>
<row>
@@ -816,7 +816,7 @@
*
</entry>
<entry colname="comments">
use attribute name=”name”
use &lt;set ...&gt; &lt;attribute name=”name” value="..." /&gt; &lt;/set&gt;
</entry>
</row>
<row>
@@ -847,7 +847,7 @@
<emphasis>*</emphasis>
</entry>
<entry colname="comments">
now attribute on flow, or implicit
now &lt;flow start-state="..."&gt;, or defaults to the first state in the flow
</entry>
</row>
<row>
@@ -997,7 +997,7 @@
*
</entry>
<entry colname="comments">
no longer supported
all Spring beans can be resolved with EL
</entry>
</row>
</tbody>

85
spring-webflow-reference/src/flow-security.xml
View File

@@ -5,8 +5,8 @@
<title>Introduction</title>
<para>
Security is an important concept for any application.
End users should not be able to access any portion of your site simply by guessing the URL.
Areas of a site that are sensitive should insure that only authorized requested are processed.
End users should not be able to access any portion of a site simply by guessing the URL.
Areas of a site that are sensitive must insure that only authorized requested are processed.
Spring Security is a proven security platform that can integrate with your application at multiple levels.
This section will focus on securing flow execution.
</para>
@@ -16,7 +16,7 @@
<para>
Securing flow execution is a three step process:
<itemizedlist>
<listitem><para>Configure Spring Security with allowed users and roles</para></listitem>
<listitem><para>Configure Spring Security with authentication and authorization rules</para></listitem>
<listitem><para>Annotate the flow definition with the secured element to define the security rules</para></listitem>
<listitem><para>Add the SecurityFlowExecutionListener to process the security rules.</para></listitem>
</itemizedlist>
@@ -28,25 +28,25 @@
<sect1 id="flow-security-secured-element">
<title>The secured element</title>
<para>
The secured element designates that its containing element should apply the authorization checks before fully entering.
This element is optional and should occur only once per stage of the flow execution that is secured.
The secured element designates that its containing element should apply the authorization check before fully entering.
This may not occur more then once per stage of the flow execution that is secured.
</para>
<para>
There are three phases of flow execution that can be secured: flows, states and transitions.
Three phases of flow execution can be secured: flows, states and transitions.
In each case the syntax for the secured element is identical.
</para>
<sect2 id="flow-security-secured-element-attributes">
<title>Security attributes</title>
<para>
The <code>attributes</code> attribute is a comma separated list of Spring Security attributes.
Often these are specific security roles.
These attributes will be compared against the user's granted attributes by a Spring Security access decision manager.
The <code>attributes</code> attribute is a comma separated list of Spring Security authorization attributes.
Often, these are specific security roles.
The attributes are compared against the user's granted attributes by a Spring Security access decision manager.
</para>
<programlisting language="xml">
&lt;secured attributes="ROLE_USER" /&gt;
</programlisting>
<para>
By default a role based access decision manager is used to determine if the user is allowed access.
By default, a role based access decision manager is used to determine if the user is allowed access.
This will need to be overridden if your application is not using authorization roles.
</para>
</sect2>
@@ -54,14 +54,15 @@
<title>Matching type</title>
<para>
There are two types of matching available: <code>any</code> and <code>all</code>.
Any will allow access if at least one of the required security attributes is granted to the user.
All allows access only if each of the required security attributes are granted to the user.
Any, allows access if at least one of the required security attributes is granted to the user.
All, allows access only if each of the required security attributes are granted to the user.
</para>
<programlisting language="xml">
&lt;secured attributes="ROLE_USER, ROLE_ANONYMOUS" match="any" /&gt;
</programlisting>
<para>
The default value is <code>any</code>.
This attribute is optional.
If not defined, the default value is <code>any</code>.
</para>
<para>
The <code>match</code> attribute will only be respected if the default access decision manager is used.
@@ -71,43 +72,48 @@
<sect1 id="flow-security-listener">
<title>The SecurityFlowExecutionListener</title>
<para>
Defining security rules in your flow by itself will not protect the flow execution.
Defining security rules in the flow by themself will not protect the flow execution.
A <code>SecurityFlowExecutionListener</code> must also be defined in the webflow configuration and applied to the flow executor.
</para>
<programlisting language="xml">
&lt;webflow:flow-executor id="flowExecutor" flow-registry="flowRegistry"&gt;
&lt;webflow:flow-execution-listeners&gt;
&lt;webflow:listener ref="securityFlowExecutionListener" /&gt;
&lt;/webflow:flow-execution-listeners&gt;
&lt;/webflow:flow-executor&gt;
<programlisting language="xml"><![CDATA[
<webflow:flow-executor id="flowExecutor" flow-registry="flowRegistry">
<webflow:flow-execution-listeners>
<webflow:listener ref="securityFlowExecutionListener" />
</webflow:flow-execution-listeners>
</webflow:flow-executor>
&lt;bean id="securityFlowExecutionListener" class="org.springframework.webflow.security.SecurityFlowExecutionListener" /&gt;
</programlisting>
<para>
If your application is using authorities that are not role based, you will need to configure a custom <code>AccessDecisionManager</code>.
You can override the default decision manager by setting the <code>accessDecisionManager</code> property on the security listener.
Please consult the Spring Security documentation to learn more about decision managers.
</para>
<programlisting language="xml">
&lt;bean id="securityFlowExecutionListener" class="org.springframework.webflow.security.SecurityFlowExecutionListener"&gt;
&lt;property name="accessDecisionManager" ref="myCustomAccessDecisionManager" /&gt;
&lt;/bean&gt;
</programlisting>
<bean id="securityFlowExecutionListener"
class="org.springframework.webflow.security.SecurityFlowExecutionListener" />
]]></programlisting>
<para>
If access is denied to a portion of the application an <code>AccessDeniedException</code> will be thrown.
This exception will later be caught by Spring Security and used to prompt the user to authenticate.
It is important that this exception be allowed to travel up the execution stack uninhibited, otherwise the end user may not be prompted to authenticate.
</para>
<sect2 id="flow-security-listener-adm">
<title>Custom Access Decision Managers</title>
<para>
If your application is using authorities that are not role based, you will need to configure a custom <code>AccessDecisionManager</code>.
You can override the default decision manager by setting the <code>accessDecisionManager</code> property on the security listener.
Please consult the <ulink url="http://static.springframework.org/spring-security/site/reference.html">Spring Security reference documentation</ulink> to learn more about decision managers.
</para>
<programlisting language="xml"><![CDATA[
<bean id="securityFlowExecutionListener"
class="org.springframework.webflow.security.SecurityFlowExecutionListener">
<property name="accessDecisionManager" ref="myCustomAccessDecisionManager" />
</bean>
]]></programlisting>
</sect2>
</sect1>
<sect1 id="flow-security-configuration">
<title>Configuring Spring Security</title>
<para>
Spring Security has robust configuration options available.
As every application and environment has its own security requirements, the Spring Security reference guide is the best place to learn about all of the available options.
As every application and environment has its own security requirements, the <ulink url="http://static.springframework.org/spring-security/site/reference.html">Spring Security reference documentation</ulink> is the best place to learn the available options.
</para>
<para>
Both the <code>booking-faces</code> and <code>booking-mvc</code> sample applications are configured to use Spring Security.
Spring Security needs to be configured for both the Spring configuration and the web.xml level.
Configuration is needed at both the Spring and web.xml levels.
</para>
<sect2 id="flow-security-configuration-spring">
<title>Spring configuration</title>
@@ -149,15 +155,16 @@
</para>
<programlisting language="xml">
&lt;filter&gt;
&lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
&lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
&lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
&lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
&lt;/filter&gt;
&lt;filter-mapping&gt;
&lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
&lt;url-pattern&gt;/*&lt;/url-pattern&gt;
&lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
&lt;url-pattern&gt;/*&lt;/url-pattern&gt;
&lt;/filter-mapping&gt;
</programlisting>
</sect2>
</sect1>
</chapter>
</chapter>
s

22
spring-webflow-reference/src/portlet.xml
View File

@@ -4,7 +4,7 @@
<sect1 id="portlet-introduction">
<title>Introduction</title>
<para>
This chapter shows you how to use Web Flow in a Portlet environment.
This chapter shows how to use Web Flow in a Portlet environment.
Web Flow has full support for JSR-168 portlets.
The <code>booking-portlet-mvc</code> sample application is a good reference for using Web Flow within a portlet.
This application is a simplified travel site that allows users to search for and book hotel rooms.
@@ -14,10 +14,10 @@
<title>Configuring web.xml &amp; portlet.xml</title>
<para>
The configuration for a portlet depends on the portlet container used.
The <code>booking-portlet-mvc</code> and <code>booking-portlet-faces</code> sample application are both configured to use <ulink url="http://portals.apache.org/pluto/">Apache Pluto</ulink>, the JSR-168 reference implementation.
The sample applications, included with Web Flow, are both configured to use <ulink url="http://portals.apache.org/pluto/">Apache Pluto</ulink>, the JSR-168 reference implementation.
</para>
<para>
In general the configuration requires adding a servlet mapping in the <code>web.xml</code> file to dispatch request to the portlet container.
In general, the configuration requires adding a servlet mapping in the <code>web.xml</code> file to dispatch request to the portlet container.
</para>
<programlisting language="xml"><![CDATA[
<servlet>
@@ -62,7 +62,7 @@
<sect2 id="portlet-config-spring-handler">
<title>Flow Handlers</title>
<para>
The only supported mechanism for bridging a portlet request to Web Flow is via a <code>FlowHandler</code>.
The only supported mechanism for bridging a portlet request to Web Flow is a <code>FlowHandler</code>.
The <code>PortletFlowController</code> used in Web Flow 1.0 is no longer supported.
</para>
<para>
@@ -78,9 +78,11 @@
<para>handle the flow execution outcome</para>
</listitem>
<listitem>
<para>handle any exceptions</para>
<para>handle exceptions</para>
</listitem>
</itemizedlist>
</para>
<para>
The <code>AbstractFlowHandler</code> class is an implementation of <code>FlowHandler</code> that provides default implementations for these hooks.
</para>
<para>
@@ -98,7 +100,7 @@ public class ViewFlowHandler extends AbstractFlowHandler {
<title>Adapter Mappings</title>
<para>
Spring Portlet MVC provides a rich set of methods to map portlet requests.
Complete documentation of the available methods is available in the <ulink url="http://static.springframework.org/spring/docs/2.5.x/reference/portlet.html#portlet-handlermapping">Spring Reference Documentation</ulink>.
Complete documentation is available in the <ulink url="http://static.springframework.org/spring/docs/2.5.x/reference/portlet.html#portlet-handlermapping">Spring Reference Documentation</ulink>.
</para>
<para>
The <code>booking-portlet-mvc</code> sample application uses a <code>PortletModeHandlerMapping</code> to map portlet requests.
@@ -132,13 +134,13 @@ public class ViewFlowHandler extends AbstractFlowHandler {
<sect2 id="portlet-config-spring-redirectonpause">
<title>Redirect on Pause</title>
<para>
In a portlet environemnt, <code>alwaysRedirectOnPause</code> must be set to <code>false</code>.
In a portlet environemnt, <code>always-redirect-on-pause</code> must be set to <code>false</code>.
If not turned off, the initial view will fail to render.
</para>
<programlisting language="xml"><![CDATA[
<webflow:flow-executor id="flowExecutor" flow-registry="flowRegistry">
<webflow:flow-execution-attributes>
<webflow:alwaysRedirectOnPause value="false"/>
<webflow:always-redirect-on-pause value="false"/>
</webflow:flow-execution-attributes>
</webflow:flow-executor>
]]></programlisting>
@@ -209,7 +211,7 @@ ${externalContext.requestMap.portletMode}
Even if the mode is mapped to a different <code>FlowHandler</code> the flow execution will resume the previous execution.
</para>
<para>
One way to start the new flow is to create a URL targeting the mode without the execution key.
One way to start a new flow is to create a URL targeting the mode without the execution key.
</para>
</sect2>
<sect2 id="portlet-issues-jsf">
@@ -218,7 +220,7 @@ ${externalContext.requestMap.portletMode}
Web Flow supports JSF as the view technology for a portlet.
However, a jsf-portlet bridge (JSR-301) must be provided.
At the time of this writing, no feature complete jsf-portlet bridge exists.
Some of the existing bridge implementations may appear to work, however, strange side effect may occur.
Some of the existing bridge implementations may appear to work, however, side effect may occur.
</para>
<para>
JSF portlets are considered experimental at this time.

15
spring-webflow-reference/src/spring-mvc.xml
View File

@@ -4,7 +4,7 @@
<sect1 id="spring-mvc-introduction">
<title>Introduction</title>
<para>
This chapter shows you how to integrate Web Flow into a Spring MVC web application.
This chapter shows how to integrate Web Flow into a Spring MVC web application.
The <code>booking-mvc</code> sample application is a good reference for Spring MVC with Web Flow.
This application is a simplified travel site that allows users to search for and book hotel rooms.
</para>
@@ -14,9 +14,8 @@
<para>
The first step to using Spring MVC is to route requests to the <code>DispatcherServlet</code> in the <code>web.xml</code> file.
In this example, we map all URLs that begin with <code>/spring/</code> to the servlet.
The servlet needs to be configured.
An <code>init-param</code> is used in the servlet to pass the <code>contextConfigLocation</code>.
This is the location of the Spring configuration for your application.
An <code>init-param</code> is used to pass the <code>contextConfigLocation</code>.
This is the location of the Spring configuration for the application.
</para>
<programlisting language="xml"><![CDATA[
<servlet>
@@ -41,7 +40,7 @@
<title>URL Mapping</title>
<para>
Inside the <code>DispatcherServlet</code> request need to be mapped with finer grain.
Using a <code>SimpleUrlHandlerMapping</code> request URLs are mapped to controllers and handlers.
Using a <code>SimpleUrlHandlerMapping</code>, request URLs are mapped to controllers and handlers.
</para>
<programlisting language="xml"><![CDATA[
<bean class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
@@ -54,7 +53,7 @@
</bean>
]]></programlisting>
<para>
For this example both a standard MVC controller and a Web Flow handler are configured.
In this example both a standard MVC controller and a Web Flow handler are configured.
The <code>hotelsController</code> supports the free navigation aspects of searching and viewing hotels.
The <code>bookingFlowHandler</code> supports the controlled navigation aspect of booking a hotel room.
</para>
@@ -63,7 +62,7 @@
<title>Flow Controllers</title>
<para>
Flow controllers provide a basic hook from Spring MVC into Web Flow.
The <code>FlowController</code> class is an implementation of an MVC Controller.
The <code>FlowController</code> class is an implementation of MVC's <code>Controller</code> interface.
</para>
<programlisting language="xml"><![CDATA[
<bean id="flowController" class="org.springframework.webflow.mvc.servlet.FlowController">
@@ -91,7 +90,7 @@
<para>handle the flow execution outcome</para>
</listitem>
<listitem>
<para>handle any exceptions</para>
<para>handle exceptions</para>
</listitem>
</itemizedlist>
</para>